CVE-2026-120192
Received Received - Intake

Information Disclosure in Presenton Desktop Authentication

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file /app_data of the component Desktop Authentication Middleware. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.12-beta is able to mitigate this issue. The name of the patch is 44c8a61122b21f17642d717b0c4d6f2c54c0f180. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120192
EUVD
EUVD-2026-114751

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a Presenton 0.9.11-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information disclosure issue in Presenton up to version 0.9.11-beta. It allows unauthenticated remote attackers to access sensitive files through improperly configured static file serving in the /app_data directory. Attackers can download files like userConfig.json (containing API keys and tokens), the SQLite database with user credentials, and log files without authentication due to the DISABLE_AUTH=true setting.

Detection Guidance

Check if Presenton is running version 0.9.11-beta or earlier. Inspect network traffic for unauthorized access to /app_data or attempts to download sensitive files like userConfig.json or fastapi.db. Look for DNS rebinding attempts targeting local services.

Impact Analysis

An attacker could exploit this to steal sensitive data such as API keys, OAuth tokens, password hashes, and JWT signing keys. They might also access user credentials stored in the database or read log files containing private information. Exploitation can occur remotely via DNS rebinding attacks or local processes.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting personal and health data. Exposure of API keys and user credentials could lead to unauthorized access to sensitive information, resulting in non-compliance with data protection regulations and potential legal consequences.

Mitigation Strategies

Upgrade Presenton to version 0.9.12-beta or later. Ensure the patch 44c8a61122b21f17642d717b0c4d6f2c54c0f180 is applied. Restrict access to /app_data and implement authentication for static file serving. Move sensitive files outside static directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart